From 9882cbef8e990c82498152d6831b91b27cfd0240 Mon Sep 17 00:00:00 2001
From: jim-p
Date: Thu, 4 Nov 2010 13:18:29 -0400
Subject: [PATCH 01/98] Use addslashes() here to prevent unescaped quotes from
causing PHP errors. Fixes advanced/custom options in OpenVPN wizard.
---
usr/local/www/wizard.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/usr/local/www/wizard.php b/usr/local/www/wizard.php
index 9dc4d80059..965a2aa90e 100755
--- a/usr/local/www/wizard.php
+++ b/usr/local/www/wizard.php
@@ -155,7 +155,7 @@ function update_config_field($field, $updatetext, $unset, $arraynum, $field_type
$text = "unset(\$config" . $field_conv . ");";
eval($text);
}
- $text = "\$config" . $field_conv . " = \"" . $updatetext . "\";";
+ $text = "\$config" . $field_conv . " = \"" . addslashes($updatetext) . "\";";
eval($text);
}
From 428e66b61b7a511e059ad836f33367837288b71c Mon Sep 17 00:00:00 2001
From: jim-p
Date: Thu, 4 Nov 2010 14:30:50 -0400
Subject: [PATCH 02/98] Warn a user when entering the OpenVPN client/server
screens that they need a CA/Cert if none exist.
---
usr/local/www/vpn_openvpn_client.php | 34 +++++++++++++++++++++-----
usr/local/www/vpn_openvpn_server.php | 36 ++++++++++++++++++++++------
2 files changed, 57 insertions(+), 13 deletions(-)
diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php
index 4b23c950e7..93eb56c3b1 100644
--- a/usr/local/www/vpn_openvpn_client.php
+++ b/usr/local/www/vpn_openvpn_client.php
@@ -46,6 +46,21 @@ if (!is_array($config['openvpn']['openvpn-client']))
$a_client = &$config['openvpn']['openvpn-client'];
+if (!is_array($config['ca']))
+ $config['ca'] = array();
+
+$a_ca =& $config['ca'];
+
+if (!is_array($config['cert']))
+ $config['cert'] = array();
+
+$a_cert =& $config['cert'];
+
+if (!is_array($config['crl']))
+ $config['crl'] = array();
+
+$a_crl =& $config['crl'];
+
$id = $_GET['id'];
if (isset($_POST['id']))
$id = $_POST['id'];
@@ -331,10 +346,17 @@ function autotls_change() {
//-->
Certificate Manager to make one.";
+if (count($a_cert) == 0)
+ $savemsg .= " You have no Certificates defined. You must visit the Certificate Manager to make one.";
+
+if ($input_errors)
+ print_input_errors($input_errors);
+if ($savemsg)
+ print_info_box($savemsg);
?>
@@ -610,7 +632,7 @@ function autotls_change() {
+ 1, or WAN with an if count of 1.
+ if (!isset($config['system']['webgui']['noantilockout']) &&
+ (((count($config['interfaces']) > 1) && ($if == 'lan'))
+ || ((count($config['interfaces']) == 1) && ($if == 'wan')))): ?>
+
', $script . '', $buffer, $count);
+ if (!$count) {
+ $buffer .= $script;
+ }
+ }
+ return $buffer;
+}
+
+/**
+ * Checks if this is a post request, and if it is, checks if the nonce is valid.
+ * @param bool $fatal Whether or not to fatally error out if there is a problem.
+ * @return True if check passes or is not necessary, false if failure.
+ */
+function csrf_check($fatal = true) {
+ if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
+ csrf_start();
+ $name = $GLOBALS['csrf']['input-name'];
+ $ok = false;
+ $tokens = '';
+ do {
+ if (!isset($_POST[$name])) break;
+ // we don't regenerate a token and check it because some token creation
+ // schemes are volatile.
+ $tokens = $_POST[$name];
+ if (!csrf_check_tokens($tokens)) break;
+ $ok = true;
+ } while (false);
+ if ($fatal && !$ok) {
+ $callback = $GLOBALS['csrf']['callback'];
+ if (trim($tokens, 'A..Za..z0..9:;,') !== '') $tokens = 'hidden';
+ $callback($tokens);
+ exit;
+ }
+ return $ok;
+}
+
+/**
+ * Retrieves a valid token(s) for a particular context. Tokens are separated
+ * by semicolons.
+ */
+function csrf_get_tokens() {
+ $has_cookies = !empty($_COOKIE);
+
+ // $ip implements a composite key, which is sent if the user hasn't sent
+ // any cookies. It may or may not be used, depending on whether or not
+ // the cookies "stick"
+ if (!$has_cookies && $secret) {
+ // :TODO: Harden this against proxy-spoofing attacks
+ $ip = ';ip:' . csrf_hash($_SERVER['IP_ADDRESS']);
+ } else {
+ $ip = '';
+ }
+ csrf_start();
+
+ // These are "strong" algorithms that don't require per se a secret
+ if (session_id()) return 'sid:' . csrf_hash(session_id()) . $ip;
+ if ($GLOBALS['csrf']['cookie']) {
+ $val = csrf_generate_secret();
+ setcookie($GLOBALS['csrf']['cookie'], $val);
+ return 'cookie:' . csrf_hash($val) . $ip;
+ }
+ if ($GLOBALS['csrf']['key']) return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
+ // These further algorithms require a server-side secret
+ if ($secret === '') return 'invalid';
+ if ($GLOBALS['csrf']['user'] !== false) {
+ return 'user:' . csrf_hash($GLOBALS['csrf']['user']);
+ }
+ if ($GLOBALS['csrf']['allow-ip']) {
+ return ltrim($ip, ';');
+ }
+ return 'invalid';
+}
+
+/**
+ * @param $tokens is safe for HTML consumption
+ */
+function csrf_callback($tokens) {
+ header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+ echo "
">
" width="17" height="17" border="0">
" width="17" height="17" border="0">